topic Re: Panorama Log storage compression details in General Topics

Panorama Log storage compression details

Sec101 — Mon, 29 Nov 2021 16:39:21 GMT

How does panorama log storage get handled when it comes to compression formats (panorama vm with log storage attached disks)? We have a setup where our vendor is guaranteeing some storage only if the vendor can compress those files in their own proprietary format. Does anyone know if panorama is compressing/storing logs in a proprietary format that could cause issues with any of this/have any experience when it comes to panorama handling log compression and the format that gets stored in?

Re: Panorama Log storage compression details

LAYER_8 — Wed, 01 Dec 2021 19:20:42 GMT

How is PRA deployed? Is it in legacy mode, where logs are in their own disk image/storage?

Because log forwarding allows for logs to be exported in whatever chosen format, and compressed from there.

Or are you meaning compressing the entire instance PRA lives inside of?

Re: Panorama Log storage compression details

Sec101 — Thu, 02 Dec 2021 16:37:20 GMT

@LAYER_8

panorama mode.

Attached disks to panorama vm.

Yes, compressed on the instance of pra itself.

Re: Panorama Log storage compression details

PavelK — Mon, 06 Dec 2021 23:26:21 GMT

Hello @Sec101

The logs are not being compressed while stored in Panorama VM. The only compression option that is available is directly on dedicated log collector for inter log collector log replication with this command: "debug log-collector inter-log-collector data-compression set on".

Kind Regards

Pavel

Re: Panorama Log storage compression details

Sec101 — Tue, 07 Dec 2021 20:33:11 GMT

@PavelK

We have a third party tool that we could use to compress the attached disks, but is that something that is advisable, or not recommended?

Re: Panorama Log storage compression details

PavelK — Tue, 07 Dec 2021 23:15:14 GMT

Thank you for reply @Sec101

when it comes to disk compression, I never came across any information in Panorama's documentation/whitepaper regarding this topic and I am not aware of anybody who actually tried it, so I hesitate to comment on this. At least for me I do not think I recommend it.

Kind Regards

Pavel